Enabling Nexus Remote Support and Nexus Remote Management for Qumulo Core

This section explains how to create a registration key and register your Qumulo cluster from Nexus and how to enable Nexus Remote Support and Nexus Management by using the qq CLI.

Qumulo Nexus includes two remote access components:

For clusters that run Qumulo Core 7.7.0 (and higher), Nexus Remote Support lets the Qumulo Care Team access your cluster and work on it remotely.
For clusters that run Qumulo Core 7.7.3 (and higher), Nexus Remote Management lets users in your organization with single sign-on (SSO) manage your cluster from Nexus.

Important
To let the Qumulo Care Team provide fast support when you need it most, we strongly recommend enabling both Nexus Remote Support and Nexus Remote Management.

Prerequisites

Administrative access to your organization’s Nexus account
TCP traffic on port 443 for the api.nexus.qumulo.com hostname to allow Nexus connectivity
For Nexus Remote Management:
- A configured identity provider (IdP) and enabled SSO for Nexus
  
  Tip
  For more information, see the storage administrator workflow or the system administrator workflow.
- A Qumulo cluster joined to Active Directory (AD)
- Users configured in your IdP with the following roles in Nexus:
  - View or Admin
  - Cluster API Access
- Users who log in to Nexus by using the IdP resolve to AD users.
  
  Note
  The resolved AD user must have appropriate RBAC roles assigned in Qumulo Core.

Step 1: Create a Registration Key in Qumulo Nexus

A registration key associates your Qumulo cluster with your Qumulo Nexus account. It works like a one-time password and is valid for 14 days after being created.

Important

Nexus displays the registration key only once. Copy this key to a secure location.
If you misplace your key before registering your cluster or before it expires:
1. In the Manage Registration Keys section, locate the key, and then click Revoke.
2. Create a new key.
Revoking a registration key is a permanent action. However, you can create a new registration key at any time.

Log in to Qumulo Nexus.
In the upper-right corner, click your username and then click User Settings.
On the User Settings page, click Registration Keys.
Enter the Key Name to identify your registration key and then click Create Key.
In the Registration Key Created dialog box, click Copy Key and then click Done.

Your registration key appears in the Registered Keys section, which shows the key’s name, creation date, and expiration date.

When you use the registration key to register your cluster with Nexus, Nexus removes the key from this the Registered Keys list.

Step 2: Register Your Cluster with Nexus

Run the qq nexus_set_registration command with the --join-key flag and specify your registration key. For example:

qq nexus_set_registration \
  --join-key "1A2B3CDEF4"

Step 3: Enable Nexus Remote Support and Nexus Remote Management

Important
To let the Qumulo Care Team provide fast support when you need it most, we strongly recommend enabling both Nexus Remote Support and Nexus Remote Management.

To Enable Nexus Remote Support

For clusters that run Qumulo Core 7.7.0 (and higher), Nexus Remote Support lets the Qumulo Care Team access your cluster and work on it remotely.

Run the qq nexus_set_config command with the --enable and --enable-remote-support flags. For example:

qq nexus_set_config \
  --enable \
  --enable-remote-support

When you enable Nexus Remote Support, Qumulo Core assigns the qumulosupport:everyone trustee to the Qumulo-Support RBAC role. This RBAC role determines the level of REST API access that Nexus gives to the Qumulo Care Team. For more information, see the Qumulo-Support section in Managing Role-Based Access Control (RBAC) for Users and Groups.

To Enable Nexus Remote Management

For clusters that run Qumulo Core 7.7.3 (and higher), Nexus Remote Management lets users in your organization with single sign-on (SSO) manage your cluster from Nexus.

Important
Before you begin, review the Nexus Remote Management Prerequisites.

Run the qq nexus_set_config command with the --enable and --enable-sso flags. For example:

qq nexus_set_config \
  --enable \
  --enable-sso

Disabling Nexus Functionality

To unregister your cluster, run the qq nexus_set_registration command with the --delete flag.
To disable Nexus Remote Support, run the qq nexus_set_config command with the --disable-remote-support flag.
To disable Nexus Remote Management, run the qq nexus_set_config command with the --disable-sso flag.
To disable all Nexus functionality, run the qq nexus_set_config command with the --disable flag.